// Alloy log agent on czy, where Ledgerline's containers run.
//
// This is the Docker half of the platform's Alloy config
// (ansible/roles/observability/templates/grafana-stack/config/alloy/config.alloy.j2),
// moved here because the platform itself now runs on k3s (k8s/), where there is
// no Docker socket. Components are unchanged except loki.write, which pushes
// to the cluster's Loki over HTTPS with basic auth instead of http://loki:3100,
// and one extra relabel rule that sets service_name (see below).
//
// OTLP is NOT received here: apps send spans to the platform's Alloy at
// https://otlp.vione.cloud (k8s/alloy/config.alloy).

logging {
  level = "info"
}

discovery.docker "local" {
  host = "unix:///var/run/docker.sock"
}

discovery.relabel "docker" {
  targets = discovery.docker.local.targets

  rule {
    source_labels = ["__meta_docker_container_name"]
    regex         = "/(.*)"
    target_label  = "container"
  }

  // Not in the Ansible config. Without it Loki derives service_name from
  // `container` (ledgerline-sanctions-1), while spans carry service.name
  // "sanctions" -- and Grafana's Tempo->Loki link selects on
  // {service_name="<service.name>"}, so it matched no stream. The Compose
  // service name is the services/ directory name, i.e. the OTel service.name.
  rule {
    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
    target_label  = "service_name"
  }
}

loki.source.docker "local" {
  host       = "unix:///var/run/docker.sock"
  targets    = discovery.relabel.docker.output
  forward_to = [loki.write.default.receiver]
}

loki.write "default" {
  endpoint {
    url = sys.env("LOKI_PUSH_URL")

    basic_auth {
      username = sys.env("LOKI_PUSH_USER")
      password = sys.env("LOKI_PUSH_PASSWORD")
    }
  }
}